In the Claims 



1 to 19. (cancelled) 

20. (currently amended) A communication system comprising: 

a plurality of virtual private networks 'VPNs' interconnected by a first data 

network; 

a second data network connected to the plurality of VPNs via the first 
data network, the second data network using an Internet Protocol 'IP' network 
addressing scheme that uses different IP addresses to a private IP network addressing 
scheme used by at least one of said plurality of VPNs; and 

a VPN gnt n w a y having a VPN media proxy integrating the functionality of 
a VPN gateway with the functionality of a media proxy, the VPN media proxy directly 
interfacing the first data network and the second data network thereby connecting the 
second data network to the plurality of VPNs via the first data network, the VPN 
gateway being shared by said plurality of VPNs and providing a plurality of virtual 
routing functions, respective ones of said plurality of virtual routing functions being 
connected to respective ones of said plurality of VPNs such that each virtual routing 
function has an address in a private IP address space of a respective one of said 
plurality of VPNs, wherein the VPN media proxy is configured to pass call bearer 
packets from a source IP address in said at least one of said plurality of VPNs to a 
destination IP address in said second data network, the VPN media proxy having an IP 
address translator arranged to translate the destination IP address of the call bearer 
packets in accordance with the IP network addressing scheme of the second data 
network, and to send the call bearer packets towards the translated IP destination 
address in the second data network. 

21. (previously presented) The communication system as claimed in claim 20, 
wherein the IP address translator is arranged to translate a destination IP address of 
call bearer packets being transmitted from a source IP address in the second data 
network to a destination IP address in said at least one of said plurality of VPNs in 
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accordance with the private IP network addressing scheme of said at least one of said 
plurality of VPNs, and to send the call bearer packets towards the translated 
destination IP address in said at least one of said plurality of VPNs. 

22. (previously presented) The communication system as claimed in claim 21, 
wherein the first data network is a public data network using a public Internet Protocol 
'IP' network addressing scheme 7 and the second data network is a carrier data network 
using a private IP network addressing scheme. 

23. (previously presented) The communication system as claimed in claim 20, 
wherein, where more than one of the VPNs use a private IP network addressing 
scheme, some of said private IP network addressing schemes have overlapping 
address ranges. 

24. (previously presented) The communication system as claimed in claim 22, 
wherein the carrier data network interfaces the public data network to a switched 
telephone network 'STN' via a trunk gateway whose carrier data network IP address is 
the destination address for call bearer packets being transmitted from a source IP 
address in any of the VPNs to a destination IP address in the carrier data network. 

25. (previously presented) The communication system as claimed in claim 24, 
wherein the STN is a public STN 'PSTN'. 

26. (previously presented) The communication system as claimed in claim 24, 
wherein the VPN gateway is configured to transmit call signaling information between 
said at least one of said plurality of VPNs and the carrier data network via the public 
data network and the VPN media proxy being configured to transmit call bearer 
packets comprising a call between said at least one of said plurality of VPNs and the 
carrier data network via the public data network once a call has been established in 
response to said transmission of call signaling information, the IP address translator of 
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the VPN media proxy being configured to translate a destination IP address of said call 
bearer packets to the carrier data network IP address of the trunk gateway. 

27. (presented presented) The communication system of claim 26, wherein the call 
signaling comprises voice over IP 'VoIP' call signaling and the call comprises a VoIP 
call. 

28. (cancelled) 

29. (previously presented) The communication system as claimed in claim 20, 
wherein the address translator of the VPN media proxy is configured to provide an IP 
network address translation function to each of the virtual routing functions. 

30. (currently amended) A method of address translation in a communication system 
comprising a plurality of virtual private networks 'VPNs' interconnected by a first data 
network; a second data network connected to the plurality of VPNs via the first data 
network, the second data network using an Internet Protocol 'IP' network addressing 
scheme that uses different IP addresses to a private IP network addressing scheme 
used by at least one of said plurality of VPNs; and a VPN gat e way hav i ng a VPN media 
proxy integrating the functionality of a VPN gateway with the functionality of a media 
proxy, the VPN media proxy directly interfacing the first data network and the second 
data network thereby connecting the second data network to the plurality of VPNs via 
the first data network, the method comprising: 

providing in the VPN gateway a plurality of virtual routing functions, 
respective ones of said plurality of virtual routing functions being connected to 
respective ones of said plurality of VPNs such that each virtual routing function is has 
an address in a private IP address space of a respective one of said plurality of VPNs; 

passing call bearer packets via the VPN media proxy from a source IP 
address in said at least one of said plurality of VPNs to a destination IP address in said 
second data network; 
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at an IP address translator of the VPN media proxy, translating the 
destination IP address of the call bearer packets in accordance with the network 
addressing scheme of the second data network, and 

sending the call bearer packets towards the translated IP destination 
address in the second data network. 

31. (previously presented) The method as claimed in claim 30, wherein the IP address 
translator translates a destination IP address of call bearer packets being transmitted 
from a source IP address in the second carrier data network to a destination IP address 
in said at least one of said plurality of VPNs in accordance with the private IP network 
addressing scheme of said at least one of said plurality of VPNs, and sends the call 
bearer packets towards the translated destination IP address in said at least one of 
said plurality of VPNs. 

32. (cancelled) 

33. (previously presented) The method as claimed in claim 30, wherein the IP address 
translator of the VPN media proxy provides an IP network address translation function 
to each of the virtual routing functions. 

34. (previously presented) The method as claimed in claim 31, wherein the first data 
network is a public data network using a public Internet Protocol 'IP' network 
addressing scheme T and the second data network is a carrier data network using a 
private IP network addressing scheme. 

35. (previously presented) The method as claimed in claim 30, wherein, where more 
than one of the VPNs use a private IP network addressing schemes, some of said 
private IP network addressing schemes have overlapping address ranges. 

36. (previously presented) The method as claimed in claim 34, wherein the carrier 
data network interfaces the public data network to a switched telephone network 'STN' 
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via a trunk gateway whose carrier data network IP address is the destination IP 
address for call bearer packets being transmitted from a source IP address in any of 
the VPNs to a destination IP address in the carrier data network. 

37. (previously presented) The method as claimed in claim 36, wherein the STN is a 
public STN 'PSTN'. 

38. (previously presented) The method as claimed in claim 36, wherein the VPN 
gateway transmits voice over IP 'VoIP' call signaling information between said at least 
one of said plurality of VPNs and the carrier data network via the public data network 
and the VPN media proxy transmitting call bearer packets comprising a VoIP call 
between said at least one of said plurality of VPNs and the carrier data network via the 
public data network once a VoIP call has been established in response to said 
transmission of VoIP call signaling information, the IP address translator of the VPN 
media proxy translating a destination IP address of said call bearer packets to the 
carrier data network IP address of the trunk gateway. 

39. (currently amended) A virtual private network 'VPN' media proxy integrating the 
functionality of a VPN gateway hav i ng and a VPN media proxy for a communication 
system comprising a plurality of virtual private networks 'VPNs' interconnected by a first 
data network and a second data network connected to the plurality of VPNs via the first 
data network, the second data network using an Internet Protocol 'IP' network 
addressing scheme that Is uses different IP addresses to a private IP network 
addressing scheme used by at least one of said plurality of VPNs; the VPN media 
gateway comprising: 

a first interface for directly interfacing with the first data network; 

a second interface for directly interfacing with the second data network, 
said first and second interfaces connecting the second data network to the plurality of 
VPNs via the first data network; 

a plurality of virtual routing functions, respective ones of said plurality of 
virtual routing functions being connected to respective ones of said plurality of VPNs 
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such that each virtual routing function has an address in a private IP address space of 
a respective one of said plurality of VPNs whereby said VPN gateway is shared by said 
plurality of VPNs; and 

means for passing call bearer packets from a source IP address in said 
at least one of said plurality of VPNs to a destination IP address in said second data 
network, said means for passing call bearer packets comprising an IP address 
translator for translating the destination IP address of the call bearer packets in 
accordance with the IP network addressing scheme of the second data network and 
sending the call bearer packets towards the translated destination IP address in the 
second data network. 

40. (previously presented) The VPN gateway as claimed in claim 39, wherein the IP 
address translator is arranged to translate a destination IP address of call bearer 
packets being transmitted from a source IP address in the second data network to a 
destination IP address in said at least one of said plurality of VPNs in accordance with 
the private IP network addressing scheme of said at least one of said plurality of VPNs, 
and to send the call bearer packets towards the translated destination IP address in 
said at least one of said plurality of VPNs. 

41. (cancelled) 

42. (previously presented) The VPN gateway as claimed in claim 39, wherein the IP 
address translator of the VPN media proxy is configured to provide an IP network 
address translation function to each of the virtual routing functions. 

43. (previously presented) The VPN gateway as claimed in claim 40, wherein the first 
data network is a public data network using a public Internet Protocol 'IP' network 
addressing scheme T and the second data network is a carrier data network using a 
private IP network addressing scheme, the carrier data network interfaces the public 
data network to a switched telephone network 'STN' via a trunk gateway whose carrier 
data network IP address is the destination IP address for call bearer packets being 
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transmitted from a source IP address in any of the VPNs to a destination IP address in 
the carrier data network, a VPN gateway is provided to interface the public and carrier 
data networks and to transmit voice over IP 'VoIP' call signaling call bearer packets 
between said at least one of said plurality of VPNs and the carrier data network via the 
public data network and wherein the means for passing is configured to transmit call 
bearer packets comprising a VoIP call between said at least one of said plurality of 
VPNs and the carrier data network via the public data network once a VoIP call has 
been established in response to said transmission of VoIP call signaling information, 
the IP address translator being configured to translate a destination IP address of said 
call bearer packets to the carrier data network IP address of the trunk gateway. 

44. (cancelled) 

45. (previously presented) The VPN gateway as claimed in claim 43, wherein the STN 
is a public STN 'PSTN'. 

46. (previously presented) The VPN gateway as claimed in claim 40, further 
comprising a configuration store for storing configuration information comprising source 
and destinations IP addresses for call bearer packets being transmitted between an 
entity in one of said plurality of VPNs and an entity in said second data network, 
wherein said configuration information includes information associating said source and 
destination addresses with respective target addresses, said target addresses 
comprising the translated destination IP addresses in said one of said plurality of VPNs 
and said second data network. 

47. (currently amended) A computer readable medium storing computer readable 
instructions which, when executed by a processor of a computing device, cause said 
computing device to implement, in a communication system comprising a plurality of 
virtual private networks 'VPNs' interconnected by a first data network; a second data 
network connected to the plurality of VPNs via the first data network, the second data 
network using an Internet Protocol 'IP' network addressing scheme that uses different 
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IP addresses to a private IP network addressing scheme used by at least one of said 
plurality of VPNs; and a VPN gat e way hav i ng a VPN media proxy integrating the 
functionality of a VPN gateway with the functionality of a media proxy, the VPN media 
proxy directly interfacing the first data network and the second data networks thereby 
connecting the second data network to the plurality of VPNs via the first data network, 
the method comprising: 

providing in the VPN gateway a plurality of virtual routing functions, 
respective ones of said plurality of virtual routing functions being connected to 
respective ones of said plurality of VPNs such that each virtual routing function has an 
address in a private IP address space of a respective one of said plurality of VPNs; 

passing call bearer packets via the VPN media proxy from a source IP 
address in said at least one of said plurality of VPNs to a destination IP address in said 
second data network; 

at an IP address translator of the VPN media proxy, translating the 
destination IP address of the call bearer packets in accordance with the network 
addressing scheme of the second data network, and 

sending the call bearer packets towards the translated IP destination 
address in the second data network. 
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